1/ Introduction 📖

Dependency Confusion occurs when software installer script is tricked into pulling malicious code file from public repository.

How I found this bug?

2/ Recon 🔦

1⃣ I started with some Shodan recon and I found a IP that belongs to TARGET.

2⃣ Using directory brute forcing tools like Dirsearch and FFUF, I found a package.json file contained all the packages which was installed in the server.
URL: /ui/package.json

Read 7 tweets

Hossein NafisiAsl

@MeAsHacker_HNA

May 16

https://twitter.com/MeAsHacker_HNA/status/1504009812417331203

#Secret3
6 Questions that Guarantee your Bounty 😈

#bugbountytips👇🏻🧵

https://twitter.com/MeAsHacker_HNA/status/1504009812417331203

1/
How does the app pass data?

parameter or path?

2/
How/Where does app Talk about users?

Cookie or API Calls?

uid or username or email or uuid?

Read 8 tweets

Hossein NafisiAsl

@MeAsHacker_HNA

May 12

How We hacked Admin Panel just by JS file:
(step by step)
#bugbounty #bugbountytips

🧵👇🏻

1/ Introduction 📖

Team gave mobile app and website.

We didn’t waste of time on mobile app and decided to work on website.

We just tried to find Admin Panel because main domain was just a single page to download the app.

2/ Subdomain Enumeration 🔎

After brute forcing the subdomains we found that website had a subdomain like that admin.target.com

When we visited the subdomain we just got that Login Portal

Read 8 tweets

Hossein NafisiAsl

@MeAsHacker_HNA

May 11

Have you ever get bounty by using default credentials?
Read this thread 🔥

#bugbountytips
🧵👇🏻

You need to have a special word list for each vendor.

This thread has most known vendors default credentials that gathered from several sources.

Default Credentials for Apache Tomcat:

2/
Default Credentials for Cisco

Read 8 tweets

Hossein NafisiAsl

@MeAsHacker_HNA

Mar 16

https://twitter.com/MeAsHacker_HNA/status/1501457590638845953

#Secret2
Bug Bounty with One-Line Bash Scripts💵😎

You can mention your favorite script. I will add them to this thread.
#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

https://twitter.com/MeAsHacker_HNA/status/1501457590638845953

2/ #Secret2

🎯 Hunt #SQLi:
👉🏻httpx -l targets.txt -silent -threads 1000 | xargs -I@ sh -c 'findomain -t @ -q | httpx -silent | anew | waybackurls | gf sqli >> sqli ; sqlmap -m sqli --batch --random-agent --level 1'

#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

Read 13 tweets

Hossein NafisiAsl

@MeAsHacker_HNA

Mar 9

https://twitter.com/MeAsHacker_HNA/status/1501452559365644294

#Secret1
Top 10 Automatic Recon Tools

#Recon #BugBounty
#100BugBountySecrets
🧵👇

https://twitter.com/MeAsHacker_HNA/status/1501452559365644294

1/

R3C0Nizer is the first ever CLI based menu-driven automated web application B-Tier recon framework ...
github.com/Anon-Artist/R3…

#Recon #BugBounty
#100BugBountySecrets
🧵👇

2/

scant3r is a module-based web security tool, our goal is to make customizable tool with providing many functions and features that what you need for write a security module....
github.com/knassar702/sca…

#Recon #BugBounty
#100BugBountySecrets
🧵👇

Read 11 tweets

Share this page!

Hossein NafisiAsl

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @MeAsHacker_HNA

Hossein NafisiAsl

Hossein NafisiAsl

Hossein NafisiAsl

Hossein NafisiAsl

Hossein NafisiAsl

Hossein NafisiAsl

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?